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ABSTRACT 

The Orion crew module (CM) is being 
designed to perform survivable land and 
water landings. There are many issues 
associated with post-landing crew survival. 
In general, the most challenging of the 
realistic Orion landing scenarios from an 
environmental control standpoint is the off- 
nominal water landing. Available power 
and other consumables will be very limited 
after landing, and it may not be possible to 
provide full environmental control within 
the crew cabin for very long after 
splashdown. Given the bulk and thennal 
insulation characteristics of the crew-worn 
pressure suits, landing in a wann tropical 
ocean area would pose a risk to crew 
survival from elevated core body 
temperatures, if for some reason the 
crewmembers were not able to remove their 
suits and/or exit the vehicle. This paper 
summarizes the analyses perfonned and 
conclusions reached regarding post-landing 
crew survival following a water landing, 
from the standpoint of the crew’s core body 
temperatures. 

INTRODUCTION 

Following long-established standard practice in 
the aircraft industry, safety provisions for 
manned spacecraft have always included some 
arrangements for survival of the crew in 
contingency situations. These provisions have 


varied across different vehicles, programs, and 
nations, but a common component has always 
been some capability for crew survival following 
an unplanned or off-nominal water landing. 

Given the geography of the U.S. manned space 
program, where all manned launches have 
taken place eastward over the Atlantic Ocean, it 
was inevitable that all of NASA’s early manned 
spacecraft would be capable of performing water 
landings. Since a water landing capability had 
to be provided, in any case, for the first 
astronauts to survive possible contingencies 
following a launch failure, it was expeditious for 
NASA to make water landing the normal mode 
of operation following a successful mission. 

This programmatic logic held true for Mercury, 
Gemini, and Apollo, and was revised only with 
the advent of the Space Shuttle. The new Orion 
spacecraft may return to water landing as the 
normal mode of operation, but with additional 
capability for post-landing crew support. 

Previous NASA Experience 

Mercury [1] 

Due to the constraints imposed by technology, 
vehicle weight, and very aggressive program 
schedules, the capability of Mercury capsules to 
sustain their sole occupants following landing 
was very limited. The capsules were always 
intended to land in the ocean; investigations into 
the possible consequences of an unplanned 
landing on dry land were also apparently very 
limited. Nevertheless, the capsules did not float 
very well, and there were no on-board provisions 
for additional vehicle flotation beyond the limited 
inherent buoyancy of the capsule. One Mercury 
capsule, that of Virgil “Gus” Grissom, was lost 
when it quickly filled with water following a 
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premature hatch opening. Another, containing a 
chimpanzee test subject named “Ham,” was 
almost lost when it sustained damage on landing 
that allowed the water to leak in more slowly. 

Mercury astronauts were provided with a small 
inflatable dinghy as part of their personal 
emergency equipment, but the only astronaut 
who needed to make use of it following his flight 
was Scott Carpenter. He came down some 250 
miles past his intended landing zone, and had to 
exit his capsule and then wait 3 hours in the 
water before being picked up. The other Mercury 
astronauts were all recovered less than an hour 
after landing. Alan Shepard and Gus Grissom 
both exited their capsules and were in the water 
briefly before being hoisted aboard a helicopter. 
“Ham,” John Glenn, Walter Schirra, and Gordon 
Cooper all remained inside their capsules until 
after the capsule was brought aboard the 
recovery ship. 


Gemini [2] 

The two-man Gemini capsule was a significantly 
enlarged and refined version of the original 
Mercury design. Gemini missions were still 
intended to conclude with a landing in the 
ocean, and again the capability of capsules to 
sustain their occupants following splashdown 
was very limited. 

In seven of the ten manned Gemini flights, at the 
end of the mission the crewmembers exited the 
vehicle while it was still in the water, and were 
then individually hoisted aboard a recovery 
helicopter. Two crews (those of Gemini 6 and 9) 
elected to remain within the capsule until after it 
was lifted onto the recovery ship. In all nine of 
these missions, the spacecraft came down very 
close to its intended landing point, and divers 
were present to quickly attach an additional 
flotation collar to the outside of the spacecraft. 
The flotation collar represented a significant 
improvement compared to Mercury, and 
lessened the danger that the spacecraft would 
fill with water and sink, either due to damage or 
when the hatches were opened. 

Only one mission, Gemini 8, had what could be 
considered a contingency or off-nominal landing. 
Following the on-orbit failure of a maneuvering 
thruster, the crew (Neil Armstrong and David 
Scott) had to conduct an emergency de-orbit to 


a pre-designated secondary landing site. The 
vehicle landed outside of helicopter range from 
the nearest aircraft carrier, and the sea was 
quite rough, with sea swells of 4 to 5 meters in 
height. However, larger land-based search and 
rescue aircraft were in the air and on the way to 
the projected landing site as soon as the 
emergency was declared. Three rescue divers 
jumping from the first aircraft to arrive were able 
to attach a flotation collar to the outside of the 
spacecraft 45 minutes after splashdown. 

Despite some nausea caused by the high seas, 
the crew were still able to climb a rescue ladder 
onto the first ship to arrive, a U.S. Navy 
destroyer, approximately 3 hours after 
splashdown. This feat may have been possible 
only because of the short duration of the flight, 
as the thruster failure occurred early in the 
mission, and Gemini 8 was in space for less 
than 11 hours. 


Apollo 

Following on the obvious utility of the Gemini 
flotation collar, the three-man Apollo spacecraft 
retained this feature, and also added some 
seemingly minor, but significant, provisions for 
crew support after landing. Should the 
spacecraft roll over after it was in the water, 
inflatable balloons called “uprighting bags,” 
installed near the top of the conical capsule 
beneath the parachutes, provided enough 
buoyancy to prevent the vehicle from remaining 
upside down. A battery-powered fan and 
ventilation openings were also added near the 
top of the vehicle, to provide fresh air and some 
cooling to the interior of the spacecraft after 
landing (with appropriate safety devices to 
prevent water ingestion or opening to vacuum 
while in space). However, support divers or 
para-jumpers were still needed in order to attach 
the separate flotation collar to the outside of the 
vehicle before the side hatch could be safely 
opened, as the base of the side hatch was only 
about 1 .6 feet above the water level in a 
perfectly calm sea. 

It was originally intended that the Apollo 
capsules would be able to land on dry land as 
well as water, but early drop testing revealed 
that the descent rates and impact loads were too 
high for safe landings on land. Correcting the 
problem would have delayed the program 
significantly, and would also have added 


2 



considerably more mass to the spacecraft. 

Given the urgent and heated nature of the 
“space race” at the time, NASA decided that a 
land landing capability for Apollo was an 
unnecessary luxury, and all the Apollo capsules 
returning from space conducted water landings 
only. 

Including the follow-on Skylab and Apollo-Soyuz 
flights, there were a total of fifteen manned 
missions of the Apollo spacecraft. All fifteen 
came down inside their planned landing zones, 
within easy helicopter range of a waiting aircraft 
carrier. At the conclusion of each of the eleven 
Apollo missions, divers first attached the 
external flotation collar, and then the three 
crewmembers opened the side hatch, exited the 
vehicle while it was still in the water, and were 
lifted aboard a recovery helicopter. The Apollo 8 
mission recorded the longest time from 
splashdown to crew recovery (88 minutes), and 
the Apollo 9 mission encountered the roughest 
sea conditions, experiencing wind waves seven 
feet (2 meters) in height. Despite the high sea, 
the Apollo 9 crew was still recovered in a near- 
average time of 49 minutes after splashdown. 

For the three long-duration Skylab missions and 
the single Apollo-Soyuz flight, the crewmembers 
remained within the capsule after splashdown, 
and did not exit the vehicle until after it was 
hoisted aboard the aircraft carrier. 


Space Shuttle 

Representing a clean break from previous NASA 
spacecraft, the reusable space shuttle was 
intended to make space travel easier, cheaper, 
more routine, and more like the operations of 
large aircraft. This entailed the adoption of 
aircraft-style runway landings, and greater risk to 
the crew in the event of an off-nominal landing. 

For the first four shuttle flights, the two crewmen 
were provided with aircraft-style ejection seats, 
parachutes, and individual survival gear. 
Following STS-4, the ejection seats were 
removed, and the crew size was increased, to 
as many as eight people on some flights. From 
the STS-5 mission through STS-51L (the 25th 
shuttle flight), the crews had no parachutes, and 
there were no provisions for exiting the vehicle 
until after landing. While it was never intended 
or imagined that a space shuttle could float after 


a water landing, a single large life raft and 
survival equipment were nevertheless provided, 
in the hope that the crew would be able to 
egress the vehicle before it sank. 

Following the loss of the space shuttle 
Challenger on STS-51L, more thorough studies 
were conducted of shuttle abort modes and 
contingency water landings. It was determined 
that, even when in controlled gliding flight, the 
shuttle’s high landing velocity compared to 
normal aircraft would most likely lead to a 
catastrophic breakup of the vehicle upon contact 
with the water. The only way for the crew to 
survive an impending water landing would be to 
bail out first. 

This realization led to the addition of an in-flight 
bailout system, carried on every subsequent 
shuttle flight, featuring pressure suits, individual 
parachutes, small enclosed personal life rafts, 
and communications and survival gear. A 
telescoping guide pole was also necessary so 
that crewmembers bailing out of the side hatch 
would not hit the wing. 

Once in the water, the greatest threat to 
surviving crewmembers was thought to be 
hypothermia (cold). An internal shuttle program 
study estimated crew survival time as more than 
12 hours immersed in 40°F water (suit only), and 
more than 22 hours in the personal life raft in 
40°F water and 40°F rain (suit plus raft). 


Orion Design Requirements 

The original concept for the Orion spacecraft 
was of a simple, flexible, economical vehicle that 
would be re-usable, and which could land safely 
on either dry land or water, under a wide variety 
of environmental conditions. It was initially 
presumed that the normal return mode would be 
to dry land, at one of several suitable sites in the 
western U.S. This was primarily due to the 
simplicity and lower cost of recovery operations 
and vehicle refurbishment, compared to a water 
landing. 

Among the various design requirements 
intended to implement the above concept, the 
following addressed post-landing crew survival 
for water landings: 
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Orion shall provide for crew survival, without 
permanent crew disability, for at least 36 
hours with the hatch closed in sea state 
conditions defined in CxP 70023, 
Constellation Program Design Specification 
for Natural Environments (DSNE), sections 
3.5.18 through 3.5.20 and 3.6.18 through 
3.6.20. 

The relevant call-outs from the Design 
Specification for Natural Environments 
document were originally documented as 
follows: 

♦ DSNE 3.5.18, Sea State for Water 
Landing (Design Limits) 

• Maximum significant wave 
height (SWH): 30 feet (9 m) 

• Maximum wind speed: 40 knots 
(20.6 m/s) 

• Minimum wave period 
associated with maximum SWH: 
12 seconds 

♦ DSNE 3.5.19, Sea State for Crew 
Rescue (Design Limits) 

• Maximum significant wave 
height (SWH): 13 feet (4 m) 
(TBR) 

• Maximum wind speed: 27 knots 
(13.9 m/s) (TBR) 

• Minimum wave period 
associated with maximum SWH: 
8 seconds (TBR) 

♦ DSNE 3.5.20, Sea Surface Temperature 
for Water Landings (Design Limits) 

• Maximum 36°C (97°F) 

• Minimum -2°C(28°F) 

• Note that sea surface 
temperature and wave height 
parameters are independent 
such that maximum wave height 
can be concurrent with minimum 
sea surface temperatures. 


Water Landing Environments 

As the design of the Orion spacecraft 
progressed, questions were raised regarding the 
survival prospects of an Orion crew that might 
find themselves at sea for 36 hours under one or 
more of the conditions listed above. A design 


study was undertaken in early 2007 that 
examined both the possible water landing 
environments, and the physiological responses 
of Orion crewmembers under a range of 
possible cabin conditions. 

This study found that the actual occurrence of a 
sea surface temperature of 36°C (97°F) was 
quite rare on an annualized, global basis, 
basically occurring only within the restricted 
waters of the Persian Gulf and southern Red 
Sea in local summer. Sea surface temperatures 
in the open ocean were found to rarely, if ever, 
exceed 31 °C (88°F). 

The DSNE note regarding the independence of 
wave height and sea surface temperatures was 
also found to need further clarification. The 
example given in the original specification, that 
maximum wave height can be concurrent with 
minimum sea surface temperatures, is true. But 
the implication that maximum wave height could 
also be concurrent with maximum sea surface 
temperatures was found to be false. In fact, a 
fairly strong negative correlation was found to 
exist between wave height and sea surface 
temperature - in general, the higher the waves, 
the colder the sea surface, and the warmer the 
water, the lower the wave heights. 

Based on these results, Section 3.5.20 of the 
DSNE was then officially revised as follows: 

♦ DSNE 3.5.20, Sea Surface Temperature 
for Water Landings (Design Limits) 

• Maximum 31°C (88°F) 

• Minimum -2°C (28°F ) 

• Note that sea surface 
temperature and wave height 
parameters are independent 
such that maximum wave height 
can be concurrent with minimum 
sea surface temperatures. 
Significant wave heights of more 
than 4 meters have not been 
observed to be concurrent with 
maximum sea surface 
temperature, except in the 
Northern Indian Ocean / Arabian 
Sea from Jun-Aug. 
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Human Thermal Modeling 

In order to assess the impact of the hot 
postlanding environments on the crew, both in 
suited and unsuited conditions, a parametric 
study was conducted using a thermal model of 
the human body, the Wissler Human Thermal 
Model (WHTM) software program [1]. The 
Wissler program has been subsequently 
adapted for the personal computer [2]. The 
Wissler program was developed by Eugene H. 
Wissler of the University of Texas at Austin to 
simulate the physical characteristics of the 
human thermal system in a transient state. The 
model divides human body into 15 cylindrical 
elements and the user is allowed to specify 
various subject, garment, and environmental 
parameters. The major body elements are 
upper torso, lower torso, head, and 3 elements 
for each arm and leg. Within each of the body 
elements there are 15 radial points or nodes that 
represent bone, muscle, fat and skin and there 
are a number of time-dependent variables and 
user specified parameters, as follows: 

Time-dependent computed variables 

• Temperatures at 15 radial nodes within 
each body element 

• Arterial and veinous blood temperatures at 
each radial node 

• Local perfusion rate at each radial node 

• Metabolic rate at each node owing to 
resting metabolism, exercise and shivering 

• Oxygen, carbon dioxide, and lactate 
concentrations in tissue and blood at each 
radial node 

• Regional rates of sweat production 

• Rate of sweat evaporation, which may be 
less that the rate of sweat production 

• Ventilation rate 

• Temperatures at up to 6 additional radial 
nodes representing clothing 

• Amount of accumulated sweat at each 
clothing node 

• Rate of heat transfer between exposed 
surfaces and the environment owing to 
convection and radiation 

User Specified Parameters 

• Subject’s weight and mean skin fold 
thickness or regional subcutaneous fat 
thicknesses 

• Thermal resistance and permeability for 
water vapor of the clothing on each body 
element 


• Resting and total metabolic rates (exclusive 
of shivering) 

• Environmental conditions, including the dry- 
bulb temperature, humidity, pressure, wind 
speed for a gas or temperature and fluid 
speed for liquid. 

• Internal air ventilation temperature, 
humidity, and flow rate. 

• Liquid cooling garment inlet temperature 
and flow rate 

The WHTM has been used successfully to 
model the human thermal response in a variety 
of suited and unsuited conditions [3,5-7], and 
compared favorably to 41 -Node Metabolic Man 
program simulations [8,9]. 

For these postlanding simulations a 154 Ibm 
crewperson was assumed. When suited, the 
previously correlated insulation properties of the 
Advanced Crew Escape Suit (ACES) with no 
liquid cooling or internal ventilation were 
assumed for the Orion analysis [5,6]. A 
metabolic rate profile was developed with the 
Medical Division, consisting of 500 BTU/hrfor 
the first hour following splashdown, followed by 
585 BTU/hr for a half hour corresponding to 
active emesis, and the remainder of the 36 
hours at 452 BTU/hr, reflecting sea sickness 
without emesis [10]. 

Selected analysis results are presented in Table 
1 and Table 2 for the unsuited and suited cases, 
respectively. The selected data were drawn 
from the 85% relative humidity cases, although 
simulations conducted at 90% and 95% relative 
humidity show substantial degradation in 
performance. Simulations were halted when 
core body temperatures rose above 38.89 °C 
(1 02 °F), the point where pyrexia tends to occur 
that is associated with severe sweating, fainting, 
dehydration and weakness. Unfortunately, as of 
now, the current standard for body core 
temperature as defined in CxP 70024, 
Constellation Program Human-Systems 
Integration Requirements (HSIR), is the lower 
value of 38.0 °C (1 00.4 °F). The suited 
performance is substantially less than the 
unsuited case, requiring air at a given flow rate 
and humidity, to be about 9 °C (16.2 °F) colder 
than the unsuited case for the same core 
temperatures. At air flow rates of 0.0244 m/s 
(100 acfm), tolerable cabin air temperatures 
were 33.3 °C (92 °F) and 24.4 °C (76 °F), for the 
unsuited and suited configurations, respectively. 
At flow rates of 0.0049 m/s (20 acfm), tolerable 
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Table 1 

Shirtsleeve 36-hour Postlanding Analysis 
Selected Results 



Air Flow Rate 

Core 

Temperature 

Time to Reach 
Core Temp 
Limit 

Deg C 

Deg F 

m/s 

(acfm) 

Deg C 

Deg F 

Hours 

21.1 

70 


ISSBj 




21.1 

70 


isKS 


gSHEH 


21.1 

70 


WMM 




21.1 

70 


beem 


H&l 


27.8 

82 

0.0049 

(20) 

37.06 

98.7 


27.8 

82 

0.0085 

(35) 


^sggigg 


27.8 

82 

0.0122 

(50) 




27.8 

82 

0.0244 

o 

o 




32.2 

90 

0.0049 

(20) 




32.2 

90 

0.0085 

(35) 




32.2 

90 

0.0122 

(50) 




32.2 

90 

0.0244 

(100) 




33.3 

92 

0.0049 

(20) 

>38.89 

>102.0 

5.96 

33.3 

92 

0.0085 

(35) 

>38.89 

>102.0 

8.47 

33.3 

92 

0.0122 

(50) 

>38.89 

>102.0 

15.32 

33.3 

92 

0.0244 

(100) 

38.17 

100.7 


35.6 

96 

0.0049 

(20) 

>38.89 

>102.0 

2.21 

35.6 

96 

0.0085 

(35) 

>38.89 

>102.0 

2.39 

35.6 

96 

0.0122 

(50) 

>38.89 

>102.0 

2.57 

35.6 

96 

0.0244 

(100) 

>38.89 

>102.0 

3.15 


Table 2 

Suited 36-hour Postlanding Parametric Analysis 
Selected Results 


Vehicle 

Environment 

Temperature 

Air Flow Rate 

Core 

Temperature 

Time to Reach 
Core Temp 
Limit 

Deg C 

Deg F 

m/s 

(acfm) 

| Deg C 

Deg F 

Hours 

22.2 

72 

0.0049 

(20) 


■hhiem 


22.2 

72 

0.0085 

(35) 


awgisisM 


22.2 

72 

0.0122 

(50) 




22.2 

72 

0.0244 

(100) 




23.3 

74 

0.0049 

(20) 

>38.89 

>102.0 

16.59 

23.3 

74 

0.0085 

(35) 

>38.89 

>102.0 

35.90 

23.3 

74 

0.0122 

(50) 

39.17 

100.7 


23.3 

74 

0.0244 

(100) 




24.4 

76 

0.0049 

(20) 

>38.89 

>102.0 

8.64 

24.4 

76 

0.0085 

(35) 

>38.89 

>102.0 

11.09 

24.4 

76 

0.0122 

(50) 

>38.89 

>102.0 

14.67 

24.4 

76 

0.0244 

(100) 

38.28 

100.9 


25.5 

78 

0.0049 

(20) 

>38.89 

>102.0 

5.88 

25.5 

78 

0.0085 

(35) 

>38.89 

>102.0 

6.81 

25.5 

78 

0.0122 

(50) 

>38.89 

>102.0 

7.83 

25.5 

78 

0.0244 

(100) 

>38.89 

>102.0 

13.03 

■cMB 

88 

0.0049 

(20) 

>38.89 

>102.0 

2.16 

31.1 

88 

0.0085 

(35) 

>38.89 

>102.0 

2.24 

31.1 

88 

0.0122 

(50) 

>38.89 

>102.0 

2.30 

31.1 

88 

0.0244 

(100) 

>38.89 

>102.0 

2.48 

35.6 

96 

0.0049 

(20) 

>38.89 

>102.0 

1.40 

35.6 

96 

0.0085 

(35) 

>38.89 

>102.0 

1.41 

35.6 

96 

0.0122 

(50) 

>38.89 

>102.0 

1.42 

35.6 

96 

0.0244 

(100) 

>38.89 

>102.0 

1.44 


cabin air temperatures were 32.2 °C (90 °F) and 
22.2 °C (72 °F), for the unsuited and suited 
configurations, respectively. Clearly, the 
capability to remove the suits would be highly 
favorable for controlling core body temperature 
in a prolonged postlanding scenario. Airflow 
rate is also an important factor. 


A preliminary analysis of the cabin temperature 
and humidity increase using ARPCS2AT2 [11], a 
computer math model for determining 
atmospheric pressure and composition control, 
indicated for the low flow rate cases 0.0049 m/s 
(20 acfm) that air temperatures would rise by 
about 4.4 °C (8 °F) for a crew of 6 and assuming 
a cabin volume of 15.6 m 3 (550 ft 3 ). Humidity 
also increased significantly. This study modeled 
the wall temperature as a constant, and did 
account for “soakback” heating from re-entry. 

Operational Implications and Concerns 

The above results constituted a significant 
concern for post-landing crew survival under off- 
nominal conditions in warm, tropical ocean 
areas. Despite the relaxation of the original 
environmental specifications for water landings, 
it was found that approximately 24 percent of 
randomly-located water landings would still 
result in interior cabin temperatures too warm for 
36 hours of crew survival inside the capsule with 
the hatches closed, even if the crew removed 
their pressure suits after landing. This led to a 
recommendation to delete the words “with the 
hatch closed” from the high-level water survival 
requirement cited above. In the event that post- 
landing cabin temperatures were too warm for 
comfort, the crew would need to open the hatch 
and transfer to an inflatable life raft, which was 
already included on the Orion crew equipment 
list. This operational solution was deemed 
acceptable by some, since, for randomly-located 
water landings, the probability of high 
temperatures requiring crew egress to the life 
raft occurring simultaneously with rough sea 
conditions prohibiting crew egress was 
calculated at approximately 0.0002 (0.02%). 

However, others remained concerned about the 
ability of the crewmembers, who might be 
physically deconditioned after a long stay in 
space, to even remove their pressure suits after 
landing, much less egress the vehicle and get 
into a life raft. A second, more detailed study 
was therefore initiated, with the objective of 
determining what would be required in order to 
provide sufficient cooling after landing so that 
the crew would not need to remove their 
pressure suits or egress the vehicle until rescue 
and recovery forces arrived. Among the 
additional factors to be considered in the second 
study, which were not addressed in the first, 
were: 
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• Additional heating within the vehicle caused 
by re-entry 

• Additional heating caused by solar energy 
on the outside of the vehicle as it floated in 
the water after landing 

• Integrated transient modeling of the cabin 
wall temperature, air temperature and cabin 
humidity 

• Cooling effect of the water on the outside of 
the vehicle 

• Hourly variations in the air and water 
temperatures at the landing site 

• A more conservative upper limit on the core 
body temperature of the astronauts of 
approximately 100.5 °F, instead of the 102.0 
°F used in the first study 

• Transient metabolic heat effects due to 
physical exertion from removing the suit (a 
demanding task, especially for 
deconditioned crewmembers) 

This ongoing analysis effort is being led by 
Cindy Cross of Johnson Space Center, Crew 
and Thermal Systems Division, and involves a 
team of analysts, including the authors, and will 
be the subject of a future paper. 

Conclusions 

If some active means of rejecting the crew’s 
body heat is not provided, the most important 
factor in minimizing the risk of crew overheating 
becomes removing the suit. Increasing the rates 
of air flow and air exchange with the outside 
environment are also important factors in 
controlling cabin humidity, cabin air temperature, 
and the crew’s body temperatures. 

Based on a desire to permit the crew to remain 
in their suits for a reasonable period of time after 
landing, even in a warm environment, options 
are currently being investigated which will 
provide some active cooling to the crew after 
landing. Since all the options identified to date 
involve at least some weight increase to the 
vehicle, this is proving to be a very challenging 
integrated problem, requiring multiple iterations 
of analysis, system design, and review. 
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